January 27, 2020
On January 15, Washington state lawmakers introduced H.B. 2485, proposed legislation that would impose privacy and informed consent requirements on direct-to-consumer (DTC) genetic-testing companies for their collection, use and disclosure of genetic data. If enacted, H.B. 2485 (available here) would require DTC genetic-testing companies offering products or services to Washington residents to have specific language in their informed consent forms, privacy policies and third-party contracts and provide Washington consumers certain rights with respect to their genetic data and biological samples.
Applicability and Scope
H.B. 2485 would apply to any entity, regardless of its location, that offers genetic testing products or services directly to Washington residents without requiring the involvement of a healthcare provider. The law strives to protect consumers’ genetic data, which includes raw sequence data resulting from DNA sequencing, genotypic and phenotypic information resulting from analysis of the raw sequence data and self-reported health data that consumers submit to the DTC genetic-testing company regarding his/her health conditions and that is used for scientific research or product development and analyzed in connection with consumer’s raw sequence data.
H.B. 2485 would not apply to "de-identified” genetic data, which the bill defines as data that cannot reasonably be used to infer information about, or otherwise be linked to, an identifiable consumer. Importantly, under H.B. 2485, merely stripping genetic data of identifiable information would be insufficient to be considered “de-identified” under the definition of the term. In order to be de-identified, the genetic data would also need to be subject to (i) administrative and technical measures to ensure it cannot be associated with a particular consumer; (ii) public commitment by the company to maintain and use data in de-identified form and not to attempt to re-identify it; and (iii) legally enforceable contractual obligations with any third-party recipients of the data prohibiting those recipients from attempting to re-identify it.
Informed Consent Requirements
The proposed law seeks to require DTC genetic-testing companies to obtain robust informed consent from consumers for the collection, use, or disclosure of their genetic information. In addition to requiring written consent for the collection of genetic data, the law would also require separate consent for certain types of third-party disclosures, as well as for marketing to a consumer based on his/her genetic data or purchase history. Additionally, if enacted, H.B. 2485 would be the first genetic privacy law to require DTC genetic-testing companies to obtain informed consent consistent with the Federal Policy for the Protection of Human Subjects (the “Common Rule”) in order to use identifiable genetic data for research purposes, or to transfer or disclose such data to third parties for research purposes.
Privacy Policies and Practices
Implications for DTC Genetic-Testing Companies
Washington is just one of several states that have recently enacted robust genetic privacy laws and we expect other states to propose genetic privacy requirements. Lawmakers will need to clarify a number of ambiguous terms and concepts in the current draft of H.B. 2485, including the definition of the terms “offer” and “directly” and the requirements for operationalizing certain informed consent elements, such as the right to specify the retention period for one’s genetic data.